Override flag for Haskell package?

I am trying to set a flag on a Haskell package but can’t quite get there. The package in question is cryptostore which has the flag use_crypton. When present the dependecies cryptonite and x509 are supposed to change to crypton and crypton-x509. I am doing all this in an overlay:

myOverlay = final: prev: {

  customHaskellPackages = prev.haskell.packages.ghc964.override {
    overrides = hfinal: hprev: {

      # the flag override that doesn't quite work
      cryptostore = final.haskell.lib.compose.enableCabalFlag "use_crypton" hprev.cryptostore;

      # other haskell package overrides...
    };
  };

  # other nixpkgs package overrides...
};

But when cryptostore gets built I see the following error:

building '/nix/store/qsfiswjrciq3vjgdw3rb3p8nmz64gmy5-cryptostore-0.3.1.0.drv'...
Running phase: setupCompilerEnvironmentPhase
Build with /nix/store/lnp12bydmfwjf19wbnw0xzynq1xx86ad-ghc-9.6.4.
Running phase: unpackPhase
unpacking source archive /nix/store/1vsibs44iv0y8c1smi3jff4pnh5ny5h7-cryptostore-0.3.1.0.tar.gz
source root is cryptostore-0.3.1.0
setting SOURCE_DATE_EPOCH to timestamp 1000000000 of file cryptostore-0.3.1.0/tests/X509/Tests.hs
Running phase: patchPhase
Running phase: compileBuildDriverPhase
setupCompileFlags: -package-db=/build/tmp.xyvGl6hoQ4/setup-package.conf.d -j16 +RTS -A64M -RTS -threaded -rtsopts
[1 of 2] Compiling Main             ( Setup.hs, /build/tmp.xyvGl6hoQ4/Main.o )
[2 of 2] Linking Setup
Running phase: updateAutotoolsGnuConfigScriptsPhase
Running phase: configurePhase
configureFlags: --verbose --prefix=/nix/store/7qmabdx3x56psffcmg5mhkhjnqngkzfw-cryptostore-0.3.1.0 --libdir=$prefix/lib/$compiler/lib --libsubdir=$abi/$libname --docdir=/nix/store/zhnmmz0gkz3qrqblgmn2q6k33276a77r-cryptostore-0.3.1.0-doc/share/doc/cryptostore-0.3.1.0 --with-gcc=gcc --package-db=/build/tmp.xyvGl6hoQ4/package.conf.d --ghc-options=-j16 +RTS -A64M -RTS --enable-library-profiling --profiling-detail=exported-functions --disable-profiling --enable-shared --disable-coverage --enable-static --disable-executable-dynamic --enable-tests --disable-benchmarks --enable-library-vanilla --disable-library-for-ghci --enable-split-sections --enable-library-stripping --enable-executable-stripping --ghc-options=-haddock -fuse_crypton --extra-lib-dirs=/nix/store/j4m3lwhh4x0bzilvi77d512ahry775nq-ncurses-6.4/lib --extra-lib-dirs=/nix/store/kbg5m7fyi1w23fyfmxjhhzcbd577rpg0-libffi-3.4.6/lib --extra-lib-dirs=/nix/store/r20kl3djvc3r5w5a0gwy4d896mn6b22a-elfutils-0.191/lib --extra-lib-dirs=/nix/store/rx6nkd40819acppajq29g1hxa4d9r35f-gmp-with-cxx-6.3.0/lib
Using Parsec parser
Configuring cryptostore-0.3.1.0...
CallStack (from HasCallStack):
  withMetadata, called at libraries/Cabal/Cabal/src/Distribution/Simple/Utils.hs:368:14 in Cabal-3.10.1.0:Distribution.Simple.Utils
Error: Setup: Encountered missing or private dependencies:
crypton, crypton-x509, crypton-x509-validation

Inspection of qsfiswjrciq3vjgdw3rb3p8nmz64gmy5-cryptostore-0.3.1.0.drv shows that it is referring to the wrong deps:

...
("propagatedBuildInputs",
...
/nix/store/0lsim5m0l108l9w7mr58jrhv0gglxyz7-cryptonite-0.30 
/nix/store/vx6kisjalhzxxiwza35x6fxb1jsmhd3k-x509-1.7.7 
/nix/store/q885p789nl2shas0znnbfs6mmlmn8kca-x509-validation-1.6.12"
)
...

So some part of the build process is correctly going for the flag-triggered deps (crypton, crypton-x509) but some part is still looking for the unflagged deps (cryptonite, x509).

All this is in a nixos-unstable snapshot from June 4, 2024.

I am stuck. Any pointers?